amazon-web-services - Terraform RDS 实例 monitoring_role_arn 不起作用

Question

我正在尝试使用 Terraform 创建一个 AWS RDS DB 实例。我正在尝试使用 PostgreSQL 12 作为数据库。除了我无法在脚本中指定“monitoring_role_arn”的监控部分之外，一切似乎都很好。

以下是我创建 PostgreSQL 数据库实例的 Terraform 脚本:

rds.tf

# AWS PSQL RDS Instance 
resource "aws_db_instance" "test-DB" {

  depends_on = [aws_security_group.test-PSQL-DB-SG, aws_iam_role.test-IAM-Role-RDS]

  // General Configurations
  name                 = "testdb"
  identifier = "am-poc-spoke1-db"
  engine               = "postgres"
  engine_version       = "12.5"
  instance_class       = "db.t2.micro" 
  parameter_group_name = "default.postgres12"
  port = "5432"

  // Authentication
  username             = "postgres"
  password             = "postgres"

  // Storage Configurations
  storage_type = "gp2"
  allocated_storage    = 20
  max_allocated_storage = 100

  // Networking and Security 
  vpc_security_group_ids = [aws_security_group.test-PSQL-DB-SG.id]
  availability_zone = "ap-southeast-1a"
  publicly_accessible = false

  // Backup Configuration
  backup_retention_period = 7
  backup_window = "16:00-16:30"
  copy_tags_to_snapshot = true

  // Monitoring and Performance Insight
  performance_insights_enabled = true
  performance_insights_retention_period = 7

  monitoring_interval = "60"
  monitoring_role_arn = aws_iam_role.test-IAM-Role-RDS.arn
  enabled_cloudwatch_logs_exports = ["postgresql"]

  // Other Configurations
  auto_minor_version_upgrade = false
  deletion_protection = false
  skip_final_snapshot = true

  tags = {
    Name = "test-DB"
  }
}

由于“monitoring_role_arn”需要具有“AmazonRDSEnhancedMonitoringRole”策略的 AWS IAM 角色，因此我也为此创建了一个脚本。

iam-role.tf

# IAM Role for RDS Enhanced Monitoring
resource "aws_iam_role" "test-IAM-Role-RDS" {

  name = "test-IAM-Role-RDS"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })

  tags = {
    Name = "test-IAM-Role-RDS"
  }
}

然后是添加到 IAM 角色的策略。

iam-role-policy.tf

# IAM Role Policy for RDS Enhanced Monitoring
resource "aws_iam_role_policy" "test-Enhanced-Monitoring-Policy" {

  depends_on = [aws_iam_role.test-IAM-Role-RDS]

  name = "test-Enhanced-Monitoring-Policy"
  role = aws_iam_role.test-IAM-Role-RDS.id

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogGroups",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:PutRetentionPolicy"
            ],
            "Resource": [
                "arn:aws:logs:*:*:log-group:RDS*"
            ]
        },
        {
            "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogStreams",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:*:*:log-group:RDS*:log-stream:*"
            ]
        }
    ]
  })
}

运行 'terraform plan' 时不会显示错误。但是一旦我运行 'terraform apply'，我就会收到以下错误。

Error: Error creating DB Instance: InvalidParameterValue: IAM role ARN value is invalid or does not include the required permissions for:ENHANCED_MONITORING │ status code: 400, request id:59e6127d-f39a-453d-885a-868e38415fc1, {

现在有人可以解决这个问题吗？

Answer 1

使用 AmazonRDSEnhancedMonitoringRole 托管策略，而不是使用 内联策略。也就是说，我们已将 AWS 托管策略直接添加到我们的 IAM 角色中。

另外，我在 IAM 角色中将 Service 从 ec2.amazonaws.com 更改为 monitoring.rds.amazonaws.com。错误实际上是被触发的，因为我们没有这个改变。认为它也适用于内联策略，但我们可以避免仅使用 AWS 托管策略的额外代码行，而不是创建新的内联策略。

全部更改:

iam.tf

# IAM Role for RDS Enhanced Monitoring
resource "aws_iam_role" "test-IAM-Role-RDS" {

  name = "test-IAM-Role-RDS"
  assume_role_policy = jsonencode({
         Version = "2012-10-17"
          Statement = [
            {
              Action = "sts:AssumeRole"
              Effect = "Allow"
              Sid    = ""
              Principal = {
                Service = "monitoring.rds.amazonaws.com"
             }
            },
          ]
        })

  managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"]

  tags = {
    Name = "test-IAM-Role-RDS"
  }
}